Quick answers
- Is CVE-2024-40624 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-40624 being exploited in the wild.
- How severe is CVE-2024-40624?
- Critical severity, with a CVSS score of 9.8, published 15 July 2024.
- Which products and versions are affected?
- torrentpier/torrentpier (Packagist) <= 2.4.3, ECOSYSTEM:introduced=0,fixed=2.4.4; TorrentPier <= 2.4.3.
- Is there a fix for CVE-2024-40624?
- Yes. torrentpier/torrentpier (Packagist): upgrade to 2.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-40624 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2024-40624?
- Check whether you run torrentpier/torrentpier (Packagist) or TorrentPier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- torrentpier/torrentpier (Packagist): upgrade to 2.4.4 or later
composer require torrentpier/torrentpier:^2.4.4
Technical details
A deserialization of untrusted data vulnerability exists in TorrentPier versions 2.4.3 and earlier. The `get_tracks()` function in `library/includes/functions.php` uses the native PHP `unserialize()` function on the contents of the `bb_t` cookie without proper validation. An unauthenticated remote attacker can exploit this by providing a specially crafted cookie containing a PHP gadget chain (such as Guzzle/FW1). Successful exploitation allows the attacker to perform arbitrary file writes and execute arbitrary PHP code on the underlying server. The issue is addressed in version 2.4.4.
Affected products
- TorrentPier TorrentPier <= 2.4.3
Identifiers
- CVE-2024-40624
- GHSA-fg86-4c2r-7wxw
Timeline
- 2024-07-13: disclosed
- 2024-07-15: advisory: GHSA-fg86-4c2r-7wxw published
- 2024-07-15: patched